From af0899de9640b4336050b07b739818fdc3add08b Mon Sep 17 00:00:00 2001 From: Ophestra Date: Fri, 1 Aug 2025 21:23:52 +0900 Subject: hst/container: mount tmpfs via magic src string There's often good reason to mount tmpfs in the container. Signed-off-by: Ophestra --- internal/app/seal_linux.go | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) (limited to 'internal/app/seal_linux.go') diff --git a/internal/app/seal_linux.go b/internal/app/seal_linux.go index d020697e..cc92db29 100644 --- a/internal/app/seal_linux.go +++ b/internal/app/seal_linux.go @@ -246,11 +246,6 @@ func (seal *outcome) finalise(ctx context.Context, sys sys.State, config *hst.Co RootFlags: container.BindWritable, } - // hide nscd from sandbox if present - nscd := "/var/run/nscd" - if _, err := sys.Stat(nscd); !errors.Is(err, fs.ErrNotExist) { - conf.Cover = append(conf.Cover, nscd) - } // bind GPU stuff if config.Enablements&(system.EX11|system.EWayland) != 0 { conf.Filesystem = append(conf.Filesystem, &hst.FilesystemConfig{Src: "/dev/dri", Device: true}) @@ -258,6 +253,12 @@ func (seal *outcome) finalise(ctx context.Context, sys sys.State, config *hst.Co // opportunistically bind kvm conf.Filesystem = append(conf.Filesystem, &hst.FilesystemConfig{Src: "/dev/kvm", Device: true}) + // hide nscd from container if present + const nscd = "/var/run/nscd" + if _, err := sys.Stat(nscd); !errors.Is(err, fs.ErrNotExist) { + conf.Filesystem = append(conf.Filesystem, &hst.FilesystemConfig{Dst: nscd, Src: hst.SourceTmpfs}) + } + config.Container = conf } -- cgit v1.3.1